A privilege escalation flaw was found in NetworkManager-vpnc, the vpnc VPN plugin for NetworkManager. nm-vpnc-service validates plugin-specific VPN configuration items for embedded newline characters, but omits the top-level NMSettingVpn user-name property from this check. This unvalidated username is later serialized verbatim into vpnc's configuration as an "Xauth username" directive. A local unprivileged user can create a VPN profile whose username contains a newline character followed by a "Password helper" directive, causing the root-privileged vpnc process to parse the injected directive and execute an attacker-chosen helper program with UID/EUID 0 when the malicious VPN connection is activated.